Palo Alto Networks PCCSE Exam - Topic 1 Question 16 Discussion

Actual exam question for Palo Alto Networks's PCCSE exam

Question #: 16
Topic #: 1

The Unusual protocol activity (Internal) network anomaly is generating too many alerts An administrator has been asked to tune it to the option that will generate the least number of events without disabling it entirely.

Which strategy should the administrator use to achieve this goal?

AChange the Training Threshold to Low

BDisable the policy

CSet the Alert Disposition to Conservative

DSet Alert Disposition to Aggressive

Show Suggested Answer

Suggested Answer: A

by Detra at May 09, 2022, 10:04 AM

Limited Time Offer

25%

Off

Get Premium PCCSE Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Lorrine

4 months ago

I'm surprised they haven't tuned it sooner, it's been a mess!

upvoted 0 times

...

Carma

4 months ago

Wait, disabling the policy entirely? That's risky!

upvoted 0 times

...

Cruz

4 months ago

Changing the Training Threshold to Low could help reduce alerts too.

upvoted 0 times

...

Phillip

4 months ago

Disagree, aggressive might catch more threats!

upvoted 0 times

...

Rosann

4 months ago

I think setting the Alert Disposition to Conservative makes sense.

upvoted 0 times

...

Carisa

5 months ago

I practiced a similar question, and I think setting the Alert Disposition to Conservative is the way to go to minimize alerts effectively.

upvoted 0 times

...

Leigha

5 months ago

I feel like disabling the policy is definitely not the answer, but I can't recall what the difference is between Conservative and Aggressive settings.

upvoted 0 times

...

Alecia

5 months ago

I think setting the Alert Disposition to Conservative might help reduce the number of alerts without turning it off completely.

upvoted 0 times

...

Willodean

5 months ago

I remember we discussed tuning alerts in class, but I'm not sure if changing the Training Threshold to Low is the best option.

upvoted 0 times

...

Jerry

5 months ago

I've seen questions like this before, so I think I can eliminate a couple of the options right away.

upvoted 0 times

...

Leatha

5 months ago

Hmm, this one seems tricky. I'll need to think carefully about the EIGRP design considerations for a data center network.

upvoted 0 times

...

Jamika

5 months ago

I'm leaning towards "Access controls for source libraries" as the best answer. That would ensure only authorized users can make changes to the source code, which seems like the most direct way to prevent unauthorized updates.

upvoted 0 times

...

Thaddeus

5 months ago

I remember there was a practice question about real client requests and EUN pages; maybe that's what happens here too?

upvoted 0 times

...